cryptoadm.h revision 12929:f2051cc42292 
1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21/*
22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24
25#ifndef	_CRYPTOADM_H
26#define	_CRYPTOADM_H
27
28#include <sys/types.h>
29#include <sys/crypto/ioctladmin.h>
30#include <cryptoutil.h>
31#include <security/cryptoki.h>
32
33#ifdef __cplusplus
34extern "C" {
35#endif
36
37#define	_PATH_KCFD		"/lib/crypto/kcfd"
38#define	TMPFILE_TEMPLATE	"/etc/crypto/admXXXXXX"
39
40#define	ERROR_USAGE	2
41
42#define	HW_PROVIDER_NCP		1
43#define	HW_PROVIDER_N2CP	2
44#define	HW_PROVIDER_N2RNG	3
45
46/*
47 * Common keywords and delimiters for pkcs11.conf and kcf.conf files are
48 * defined in usr/lib/libcryptoutil/common/cryptoutil.h.  The following is
49 * the extra keywords and delimiters used in kcf.conf file.
50 */
51#define	SEP_SLASH		'/'
52#define	EF_SUPPORTED		"supportedlist="
53#define	EF_UNLOAD		"unload"
54#define	RANDOM			"random"
55#define	UEF_FRAME_LIB		"/usr/lib/libpkcs11.so"
56
57#define	ADD_MODE	1
58#define	DELETE_MODE	2
59#define	MODIFY_MODE	3
60
61#define	REFRESH		1
62#define	NOT_REFRESH	0
63
64typedef char prov_name_t[MAXNAMELEN];
65typedef char mech_name_t[CRYPTO_MAX_MECH_NAME];
66
67typedef struct mechlist {
68	mech_name_t	name;
69	struct mechlist	*next;
70} mechlist_t;
71
72
73typedef struct entry {
74	prov_name_t	name;
75	mechlist_t	*suplist; /* supported list */
76	uint_t		sup_count;
77	mechlist_t	*dislist; /* disabled list */
78	uint_t		dis_count;
79	boolean_t	load; /* B_FALSE after cryptoadm unload */
80} entry_t;
81
82
83typedef struct entrylist {
84	entry_t	*pent;
85	struct entrylist *next;
86} entrylist_t;
87
88typedef enum {
89	NO_RNG,
90	HAS_RNG
91} flag_val_t;
92
93extern int errno;
94
95/* adm_util */
96extern boolean_t is_in_list(char *, mechlist_t *);
97extern mechlist_t *create_mech(char *);
98extern void free_mechlist(mechlist_t *);
99
100/* adm_kef_util */
101extern boolean_t is_device(char *);
102extern int fips_update_pkcs11conf(int);
103extern void fips_status_pkcs11conf(int *);
104extern char *ent2str(entry_t *);
105extern entry_t *getent_kef(char *provname,
106		entrylist_t *pdevlist, entrylist_t *psoftlist);
107extern int check_kernel_for_soft(char *provname,
108		crypto_get_soft_list_t *psoftlist, boolean_t *in_kernel);
109extern int check_kernel_for_hard(char *provname,
110		crypto_get_dev_list_t *pdevlist, boolean_t *in_kernel);
111extern int disable_mechs(entry_t **, mechlist_t *, boolean_t, mechlist_t *);
112extern int enable_mechs(entry_t **, boolean_t, mechlist_t *);
113extern int get_kcfconf_info(entrylist_t **, entrylist_t **);
114extern int get_admindev_info(entrylist_t **, entrylist_t **);
115extern int get_mech_count(mechlist_t *);
116extern entry_t *create_entry(char *provname);
117extern int insert_kcfconf(entry_t *);
118extern int split_hw_provname(char *, char *, int *);
119extern int update_kcfconf(entry_t *, int);
120extern void free_entry(entry_t *);
121extern void free_entrylist(entrylist_t *);
122extern void print_mechlist(char *, mechlist_t *);
123extern void print_kef_policy(char *provname, entry_t *pent,
124		boolean_t has_random, boolean_t has_mechs);
125extern boolean_t filter_mechlist(mechlist_t **, const char *);
126extern uentry_t *getent_uef(char *);
127
128
129/* adm_uef */
130extern int list_mechlist_for_lib(char *, mechlist_t *, flag_val_t *,
131		boolean_t, boolean_t, boolean_t);
132extern int list_policy_for_lib(char *);
133extern int disable_uef_lib(char *, boolean_t, boolean_t, mechlist_t *);
134extern int enable_uef_lib(char *, boolean_t, boolean_t, mechlist_t *);
135extern int install_uef_lib(char *);
136extern int uninstall_uef_lib(char *);
137extern int print_uef_policy(uentry_t *);
138extern void display_token_flags(CK_FLAGS flags);
139extern int convert_mechlist(CK_MECHANISM_TYPE **, CK_ULONG *, mechlist_t *);
140extern void display_verbose_mech_header();
141extern void display_mech_info(CK_MECHANISM_INFO *);
142extern int display_policy(uentry_t *);
143extern int update_pkcs11conf(uentry_t *);
144extern int update_policylist(uentry_t *, mechlist_t *, int);
145
146/* adm_kef */
147extern int list_mechlist_for_soft(char *provname,
148		entrylist_t *phardlist, entrylist_t *psoftlist);
149extern int list_mechlist_for_hard(char *);
150extern int list_policy_for_soft(char *provname,
151		entrylist_t *phardlist, entrylist_t *psoftlist);
152extern int list_policy_for_hard(char *provname,
153		entrylist_t *phardlist, entrylist_t *psoftlist,
154		crypto_get_dev_list_t *pdevlist);
155extern int disable_kef_software(char *, boolean_t, boolean_t, mechlist_t *);
156extern int disable_kef_hardware(char *, boolean_t, boolean_t, mechlist_t *);
157extern int enable_kef(char *, boolean_t, boolean_t, mechlist_t *);
158extern int install_kef(char *, mechlist_t *);
159extern int uninstall_kef(char *);
160extern int unload_kef_soft(char *provname);
161extern int refresh(void);
162extern int start_daemon(void);
163extern int stop_daemon(void);
164
165/* adm_ioctl */
166extern crypto_load_soft_config_t *setup_soft_conf(entry_t *);
167extern crypto_load_soft_disabled_t *setup_soft_dis(entry_t *);
168extern crypto_load_dev_disabled_t *setup_dev_dis(entry_t *);
169extern crypto_unload_soft_module_t *setup_unload_soft(entry_t *);
170extern int get_dev_info(char *, int, int, mechlist_t **);
171extern int get_dev_list(crypto_get_dev_list_t **);
172extern int get_soft_info(char *provname, mechlist_t **ppmechlist,
173		entrylist_t *phardlist, entrylist_t *psoftlist);
174extern int get_soft_list(crypto_get_soft_list_t **);
175extern int do_fips_actions(int, int);
176
177/* adm_metaslot */
178extern int list_metaslot_info(boolean_t, boolean_t, mechlist_t *);
179extern int list_metaslot_policy();
180extern int disable_metaslot(mechlist_t *, boolean_t, boolean_t);
181extern int enable_metaslot(char *, char *, boolean_t, mechlist_t *, boolean_t,
182    boolean_t);
183
184/* adm_hw */
185extern int do_fips_hw_actions(int, int);
186
187#ifdef __cplusplus
188}
189#endif
190
191#endif /* _CRYPTOADM_H */
192